Thief-like malware says “pay up”

By: Conner Williams
Editor in Chief

An unnamed individual has lost all of the data in their personal and departmental drives connected to Western’s server when the machine in use was infected with a computer virus.

According to an email notification from Michael Ellis, assistant director of University Computing Services at Western, the user was browsing a beer site that had advertisements on the page that “pointed to infected webpages in Switzerland.”

Ellis noted that the virus, formally referred to as “Ransomware,” used vulnerability in Adobe Flash player to download the virus onto the machine. Ransomware then laid dormant for several hours and began encrypting files late into the evening. In the morning, the user logged onto their machine and found a pop up note that explained what happened and asked for a ransom amount in order to unlock the files, or else they would be deleted within 24 hours. The requested ransom amount was not specified in the email.

All of the user’s files in their H drive and I drive were lost, but UCS reported that they were able to restore all network files to previous versions after a lengthy process. Ellis reported in the email that the UCS security infrastructure blocks about 400 intrusion attempts per hour.

UCS then gave several pieces of advice for protecting one’s files:

1. Don’t store files on your local machine – desktop or C drive. Use the H and I drive for all documents.
2. Never click on a link sent in an email, unless you know the person that sent it.
3. Do not use your office computer to browse sites of a personal nature
4. Avoid using Internet Explorer as much as possible. UCS recommends the use of Chrome and Firefox as primary browsers.
5. If you see a strange message or pop up on the screen, do not click on it.

For more information, contact the UCS service desk at (503) 838-8925

Contact the author at journaleditor@wou.edu or on Twitter @journalEIC